Extracted

• • Target

    d496e2ab91fd96c9dabdfca534027563_JaffaCakes118

  • Size

    283KB

  • MD5

    d496e2ab91fd96c9dabdfca534027563

  • SHA1

    63ec6718d8737ca04db933afbf67d50ef7baf88d

  • SHA256

    dfce23cf2deb847abe057ef682dfaec3fcf694a6c73dca43b71efd475187d305

  • SHA512

    9951846dce22af3f5528f636f8524d39fd26153fbd66b9e91b1d7459d019411cde51bd69e1dd56d26c8d5a412f40dcac7ff65b116a9a316127bf9c8feb4ffb7f

  • SSDEEP

    6144:jmcD66RRjW5JGmrpQsK3RD2u270jupCJsCxCR:acD663vZ2zkPaCxO

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2